From 52ea480543b53173b9f92550b844224d17c14c51 Mon Sep 17 00:00:00 2001 From: Joseph Sutton Date: Tue, 17 Oct 2023 14:03:33 +1300 Subject: [PATCH] tests/krb5: Expect a status code with policy errors Signed-off-by: Joseph Sutton Reviewed-by: Andrew Bartlett --- python/samba/tests/krb5/conditional_ace_tests.py | 9 +++++++++ selftest/knownfail_heimdal_kdc | 2 -- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/python/samba/tests/krb5/conditional_ace_tests.py b/python/samba/tests/krb5/conditional_ace_tests.py index 4d006d5bc5a..cb8fce74efd 100755 --- a/python/samba/tests/krb5/conditional_ace_tests.py +++ b/python/samba/tests/krb5/conditional_ace_tests.py @@ -2404,6 +2404,9 @@ class ConditionalAceTests(ConditionalAceBaseTests): client_sids=client_sids, expected_groups=client_sids, code=KDC_ERR_POLICY, + status=ntstatus.NT_STATUS_AUTHENTICATION_FIREWALL_FAILED, + event=AuditEvent.KERBEROS_SERVER_RESTRICTION, + reason=AuditReason.ACCESS_DENIED, edata=self.expect_padata_outer) def test_tgs_without_aa_asserted_identity_device_from_rodc(self): @@ -2507,6 +2510,9 @@ class ConditionalAceTests(ConditionalAceBaseTests): client_sids=client_sids, expected_groups=client_sids, code=KDC_ERR_POLICY, + status=ntstatus.NT_STATUS_AUTHENTICATION_FIREWALL_FAILED, + event=AuditEvent.KERBEROS_SERVER_RESTRICTION, + reason=AuditReason.ACCESS_DENIED, edata=self.expect_padata_outer) def test_tgs_without_service_asserted_identity_device_from_rodc(self): @@ -2610,6 +2616,9 @@ class ConditionalAceTests(ConditionalAceBaseTests): client_sids=client_sids, expected_groups=client_sids, code=KDC_ERR_POLICY, + status=ntstatus.NT_STATUS_AUTHENTICATION_FIREWALL_FAILED, + event=AuditEvent.KERBEROS_SERVER_RESTRICTION, + reason=AuditReason.ACCESS_DENIED, edata=self.expect_padata_outer) def test_tgs_without_claims_valid_device_from_rodc(self): diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc index 143206a450a..15f1ba75d3e 100644 --- a/selftest/knownfail_heimdal_kdc +++ b/selftest/knownfail_heimdal_kdc @@ -150,10 +150,8 @@ ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_aa_asserted_identity_client_from_rodc\(ad_dc\) ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_aa_asserted_identity_device_from_rodc\(ad_dc\) ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_claims_valid_both_from_rodc\(ad_dc\) -^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_claims_valid_client_from_rodc\(ad_dc\) ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_claims_valid_device_from_rodc\(ad_dc\) ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_service_asserted_identity_both_from_rodc\(ad_dc\) -^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_service_asserted_identity_client_from_rodc\(ad_dc\) ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_service_asserted_identity_device_from_rodc\(ad_dc\) # # Conditional ACE device restrictions -- 2.47.3